Google broke a rule it had respected for over fifteen years. With Android 17 QPR1distributed on Pixels on Last September 15th As part of the monthly Pixel Drop, the company introduced new APIs for developers without publishing the corresponding code on AOSP, the platform’s open source repository.
The one to report it GrapheneOSthe alternative operating system project based on the Android source code, has always been among the most attentive observers of Google’s moves on the open source front. GrapheneOS is mainly distributed on Pixel hardware, the very devices that Google favors with the new policy, and this makes the story even more paradoxical in the eyes of the project.
The new API level 37.1 brings with it, among other things, the package android.hardware.hidwhich handles connecting keyboards, mice, and game controllers. A modest addition on paper, but symptomatic of a change in approach: since Android 3.0 Honeycomb in 2011, when Google justified the choice by motivating it with the fact that that version was designed only for tablets, no release had introduced public APIs without the corresponding open source code.
The technical cause actually dates back to Android 16. Since that version, the quarterly releases QPR1 and QPR3 have become exclusive to Pixels, and arrive on AOSP only with the following QPR2 cycle. Until now, however, those builds had never brought with them new APIs for developers: Android 17 QPR1 is the first to do so, making concrete a gap that previously remained only theoretical.
Security patches aren’t for everyone
The problem isn’t just APIs. The Pixel Update Bulletin of September 2026 includes additional security fixes compared to the standard Android bulletin and, according to GrapheneOS, some of these affect components of the platform also shared by non-Pixel devices. However, other producers will have to wait Android 17 QPR2expected for December 2026, before receiving them.
GrapheneOS doesn’t mince words: “Google shouldn’t hold standard Android platform code security patches hostage to other manufacturers, but that’s exactly what they’ve started doing.”we read in a message published by the project. The team says that it has already brought its code to Android 17 QPR1 even before the September 15 release, but that it does not yet have permission to distribute it to users.
For those who maintain alternative distributions based on AOSP the problem is practical rather than ideological. Without the sources updated in real time, recompiling the system and integrating the security patches becomes a continuous chasing exercise, with weeks of gap compared to the Pixels.
Google has not publicly commented on the GrapheneOS allegations. However, the precedent weighs heavily: Android has built a large part of its global diffusion precisely on the availability of the source code for third-party producers, and any slowdown on this front fuels suspicions of an approach, for now only partial, to the more closed model of iOS.
